What you should know about the ‘Stingray’ surveillance device used by police

Toronto police have acquired at least one “Stingray” device, a type of cellphone surveillance technology controversial for the secrecy surrounding its use and its broad privacy impacts.

The force won’t say how much it paid, how many devices it owns, or when the technology was purchased. Toronto police also have not disclosed any policies related to the device, also known as an IMSI catcher, including what it plans to do with the data of thousands of innocent bystanders that will be swept up when it is used. Here’s everything we can tell you about IMSI catchers, and why you might care.

How does it work?

Dat Types

Broadly speaking, an IMSI (International Mobile Subscriber Identity) catcher mimics a cellphone tower, forcing all mobile devices within range to connect to it. In the time that the device is activated — usually under 15 minutes — it quickly captures unique identifying data from each of the cellphones within its range, and then releases those phones to reconnect to cellular networks. A “Stingray” is just one brand name; there are many makes and models. Police forces across Canada have declined to disclose which models they use, their operating range, or most other technical details, arguing that doing so would compromise investigative techniques.

How do police use the technology?

How It's used

We don’t know all the circumstances in which police have used IMSI catchers. But through a few court cases that have come to light, we do know the devices have been used to identify unknown cellphones carried by criminal suspects — usually in major drugs, guns and gang cases, where targets often change their phones to frustrate investigators.

It works like this. After getting a warrant to use the device, police follow a suspect from location to location and activate the IMSI catcher at each site, capturing unique identifiers on any cellphones carried by the suspect but also from the cellphones of whoever else is in range. Then, police go through the data and gather the cellphone identifiers that appeared at all the locations. These identifiers should belong to the suspect. With another warrant, police can connect the cellphone identifiers to subscriber information, like a name and address. And with further judicial approval, police can then find out what numbers the suspect is dialing on that phone, or wiretap the phone and listen in on conversations.

Less often, an IMSI catcher is used to track a single known cellphone. This is usually, but not always, used in exigent circumstances, like kidnappings and missing persons cases. In those cases, a device is sometimes used without a warrant.

What types of data do these devices capture?

Dat Types

IMSI catchers capture several kinds of unique identifiers that allow cellular networks to recognize a particular cellphone. The most important are [1] the cellphone’s IMSI number, a serial code associated with its SIM card and [2] its IMEI number, a serial code associated with the phone itself. This is a small sample of a raw data log from a device operated by the RCMP in a 2014 investigation, and was entered as evidence in court. This log also captured [3] the phone’s manufacturer, model, and service provider [4] the time and date and [5] a nametag for the location where the device was used. The device or devices Toronto Police own may be different.

Toronto police have said that their devices do not capture private communications like calls, texts or emails. Instead, they capture several kinds of unique identifiers that allow cellular networks to recognize a particular cellphone. Some of those are:

  • An IMSI number, a 15-digit serial code associated with a SIM card.
  • An IMEI number (short for International Mobile Equipment Identity), a 15-digit serial code associated with the phone itself.
  • The phone’s manufacturer, model, and service provider (at least in the devices the RCMP owns).

I didn’t even know I had an IMSI number. Why should I care if the police capture mine?

Privacy experts care about this technology for several reasons. For one, it is broadly intrusive: it hoovers up information on thousands of bystanders in addition to suspects. The Star analyzed RCMP IMSI catcher data logs from a two-month period in a 2014 investigation, and found that as officers targeted 11 suspects, they swept up cellphone data on at least 20,000 and as many as 25,000 bystanders. The device was used in busy urban areas, including Yorkville, Chinatown/Kensington Market, and the Dufferin Mall.

And while most people are not aware of their IMSI or IMEI number, this data is nonetheless highly identifying personal information. Because we all carry our cellphones around constantly, these unique identifiers are a proxy for you in a particular location at a particular time. Canada’s Privacy Commissioner wrote in a report that this so-called metadata “can sometimes be more revealing than content itself,” because it is objective rather than open to interpretation and can be captured on a massive scale.

The accumulation of surveillance data is another of the privacy experts’ concerns: without proper safeguards on how this data is stored and accessed, they say, police can create a massive database that reveals the location of hundreds of thousands of people through time, and who they were with. Again, police say they need a warrant to associate a name to any of this captured data. But research has shown that supposedly anonymous metadata, especially cellphone metadata, is easily linked to individuals.

Lastly, privacy experts are concerned by the lack of transparency and accountability surrounding this technology, and how secretive police have been about the devices.

Maybe I care if police have captured my cellphone data, maybe I don’t. What will police do with my information, and everyone else who isn’t the target of a criminal investigation?

Toronto police have said their third party data policies are still being developed and will be in place before the device is used. (The force has in the past asked RCMP to operate an IMSI catcher on its behalf; in 2018, two years after Toronto police denied it ever used the technology, the Star learned it had in five separate investigations.)

Comparatively, the RCMP has said that only targeted suspects’ data is passed on to investigators and everything else is firewalled off, stored securely, and eventually destroyed. But the RCMP has also said it does not provide IMSI catcher policies or guidance for other police forces. So in short, in Toronto, we don’t know.

Are there laws governing these devices?

Police need a judge’s authorization to use the device. For about a decade, the RCMP has said they used a general warrant. Then, for a few months in 2015, the RCMP did not use any warrant at all, based on legal advice. Later that year, the RCMP began using a new kind of warrant known as a Transmission Data Recorder warrant, which requires a lower threshold of evidence to obtain. Toronto police have not yet confirmed what type of warrant they use.

Under the Criminal Code, parliament must be provided with annual statistics on police use of wiretapping. This is meant as a measure of accountability: the report must include how many warrants for wiretaps were sought, how many were provided, how many were denied, and how many charges were laid as a result of this invasive mode of surveillance. The Criminal Code also requires that anyone who is the target of a wiretap be notified. No such reporting requirements exist for IMSI catchers, so we don’t know how often they are used or how useful they are in producing criminal charges. Under current laws, the thousands of people whose cellphone data is swept up when these devices are used will never know.

Who else owns or uses this technology?

Besides Toronto police and the RCMP, the Ontario Provincial Police, Calgary and Winnipeg have confirmed to the Star that they own an IMSI catcher. Spokespeople from Hamilton, Niagara, Vancouver, and the Sûreté du Québec told us that police have used this technology with the assistance of a law enforcement partner but do not own it. Police in Ottawa, Barrie, Windsor, York Region, Durham Region, Edmonton, Montreal and Halifax would not confirm whether they have used the technology, though some confirmed they do not own it.

Source